Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

More PKCS8 v2 encryption options #5656

Closed
wants to merge 3 commits into from
Closed

Conversation

tiran
Copy link
Contributor

@tiran tiran commented Dec 18, 2020

Very rough PoC for enhanced KeySerializationEncryption. @bhoefer2015 has asked me to look into the matter. The code in _private_key_pkcs8 is based on OpenSSL's apps/pkcs8.c. I haven't figured out a good user-facing API yet.

  • public API
  • documentation
  • tests
  • fix / work around LibreSSL APIs

Fixes: #4272
Signed-off-by: Christian Heimes cheimes@redhat.com

Fixes: pyca#4272
Signed-off-by: Christian Heimes <cheimes@redhat.com>
@tiran
Copy link
Contributor Author

tiran commented Dec 18, 2020

LibreSSL doesn't have PKCS8_set0_pbe.

Base automatically changed from master to main February 12, 2021 02:15
@reaperhulk
Copy link
Member

Is this something you plan to revisit @tiran?

@tiran
Copy link
Contributor Author

tiran commented Apr 11, 2021

Is this something you plan to revisit @tiran?

Yes, I'll pick up the PR in a couple of weeks. For now I'm focusing on Python 3.10 and OpenSSL 3.0.0 work. 3.10 feature freeze is in a couple of weeks.

@tiran
Copy link
Contributor Author

tiran commented Nov 8, 2021

#6569 is a simpler approach that solves basically the same problem. PR #6569 does not give users an option to select encryption algorithms. Instead it lets users opt-in for algorithm stability until the algorithm is deemed too weak.

@reaperhulk
Copy link
Member

Closing for the same reason we closed #6569. If you'd like to discuss approach and finish this out feel free to reopen.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

KeySerializationEncryption options
2 participants